2024-07-29

1 files changed, 154 insertions, 196 deletions

diff --git a/modules/unbound.nix b/modules/unbound.nix
index d10096d..dae47f8 100644
--- a/modules/unbound.nix
+++ b/modules/unbound.nix
@@ -21,216 +21,174 @@ in
     };
   };
 
-  config =
-    let
-      adblock-conf = "${config.services.unbound.stateDir}/adblock.conf";
-    in
-    mkIf cfg.enable {
-      ark.directories = [ config.services.unbound.stateDir ];
-
-      nixfiles.modules.redis.enable = true;
-
-      services = {
-        unbound = {
-          enable = true;
-
-          package = pkgs.unbound-with-systemd.override {
-            withRedis = true;
-            withTFO = true;
-          };
+  config = mkIf cfg.enable {
+    ark.directories = [ config.services.unbound.stateDir ];
+
+    nixfiles.modules.redis.enable = true;
 
-          checkconf = false;
-          settings = {
-            server = {
-              interface = with this.wireguard; [
-                "127.0.0.1"
-                "::1"
-                ipv4.address
-                ipv6.address
-              ];
-
-              local-zone = concatLists (
-                mapAttrsToList (h: _: [ "\"${h}.${cfg.domain}\" redirect" ]) my.configurations
-              );
-              local-data = concatLists (
-                mapAttrsToList (
-                  hostname:
-                  let
-                    domain = "${hostname}.${cfg.domain}";
-                  in
-                  attr:
-                  (optionals (hasAttr "wireguard" attr) (
-                    with attr.wireguard;
-                    [
-                      "\"${domain} 604800 IN A ${ipv4.address}\""
-                      "\"${domain} 604800 IN AAAA ${ipv6.address}\""
-                      "\"${domain}. A ${ipv4.address}\""
-                      "\"${domain}. AAAA ${ipv6.address}\""
-                    ]
-                    ++ concatMap (domain: [
-                      "\"${domain}. A ${ipv4.address}\""
-                      "\"${domain}. AAAA ${ipv6.address}\""
-                    ]) attr.domains
-                  ))
-                ) my.configurations
-              );
-              local-data-ptr = concatLists (
-                mapAttrsToList (
-                  hostname:
-                  let
-                    domain = "${hostname}.${cfg.domain}";
-                  in
-                  attr:
-                  (optionals (hasAttr "wireguard" attr) (
-                    with attr.wireguard;
-                    [
-                      "\"${ipv4.address} ${domain}\""
-                      "\"${ipv6.address} ${domain}\""
-                    ]
-                    ++ concatMap (domain: [
-                      "\"${ipv4.address} ${domain}\""
-                      "\"${ipv6.address} ${domain}\""
-                    ]) attr.domains
-                  ))
-                ) my.configurations
-              );
-
-              private-domain = map (domain: "${domain}.") [
-                cfg.domain
-                "local"
-              ];
-              private-address = with config.nixfiles.modules.wireguard; [
-                ipv4.subnet
-                ipv6.subnet
-              ];
-
-              access-control = with config.nixfiles.modules.wireguard; [
-                "0.0.0.0/0 refuse"
-                "::/0 refuse"
-                "127.0.0.0/8 allow"
-                "::1/128 allow"
-                "${ipv4.subnet} allow"
-                "${ipv6.subnet} allow"
-              ];
-
-              cache-min-ttl = 0;
-
-              serve-expired = true;
-              serve-expired-reply-ttl = 0;
-
-              prefetch = true;
-              prefetch-key = true;
-
-              hide-identity = true;
-              hide-version = true;
-
-              extended-statistics = true;
-
-              log-replies = false;
-              log-tag-queryreply = false;
-              log-local-actions = false;
-
-              verbosity = 0;
-
-              include = ''"${adblock-conf}"'';
-            };
-
-            forward-zone = [
-              {
-                name = ".";
-                forward-tls-upstream = true;
-                forward-addr =
-                  let
-                    mkDnsOverTls =
-                      ips: auth:
-                      map (
-                        ip:
-                        concatStrings [
-                          ip
-                          "@"
-                          auth
-                        ]
-                      ) ips;
-                  in
-                  mkDnsOverTls dns.const.quad9.default "853#dns.quad9.net";
-              }
+    services = {
+      unbound = {
+        enable = true;
+
+        package = pkgs.unbound-with-systemd.override {
+          withRedis = true;
+          withTFO = true;
+        };
+
+        checkconf = true;
+        settings = {
+          server = {
+            module-config = ''"respip validator iterator"'';
+
+            interface = with this.wireguard; [
+              "127.0.0.1"
+              "::1"
+              ipv4.address
+              ipv6.address
             ];
 
-            cachedb = with config.services.redis.servers.default; {
-              backend = "redis";
-              redis-server-host = bind;
-              redis-server-port = port;
-            };
-          };
+            local-zone = concatLists (
+              mapAttrsToList (h: _: [ "\"${h}.${cfg.domain}\" redirect" ]) my.configurations
+            );
+            local-data = concatLists (
+              mapAttrsToList (
+                hostname:
+                let
+                  domain = "${hostname}.${cfg.domain}";
+                in
+                attr:
+                (optionals (hasAttr "wireguard" attr) (
+                  with attr.wireguard;
+                  [
+                    "\"${domain} 604800 IN A ${ipv4.address}\""
+                    "\"${domain} 604800 IN AAAA ${ipv6.address}\""
+                    "\"${domain}. A ${ipv4.address}\""
+                    "\"${domain}. AAAA ${ipv6.address}\""
+                  ]
+                  ++ concatMap (domain: [
+                    "\"${domain}. A ${ipv4.address}\""
+                    "\"${domain}. AAAA ${ipv6.address}\""
+                  ]) attr.domains
+                ))
+              ) my.configurations
+            );
+            local-data-ptr = concatLists (
+              mapAttrsToList (
+                hostname:
+                let
+                  domain = "${hostname}.${cfg.domain}";
+                in
+                attr:
+                (optionals (hasAttr "wireguard" attr) (
+                  with attr.wireguard;
+                  [
+                    "\"${ipv4.address} ${domain}\""
+                    "\"${ipv6.address} ${domain}\""
+                  ]
+                  ++ concatMap (domain: [
+                    "\"${ipv4.address} ${domain}\""
+                    "\"${ipv6.address} ${domain}\""
+                  ]) attr.domains
+                ))
+              ) my.configurations
+            );
+
+            private-domain = map (domain: "${domain}.") [
+              cfg.domain
+              "local"
+            ];
+            private-address = with config.nixfiles.modules.wireguard; [
+              ipv4.subnet
+              ipv6.subnet
+            ];
 
-          enableRootTrustAnchor = true;
+            access-control = with config.nixfiles.modules.wireguard; [
+              "0.0.0.0/0 refuse"
+              "::/0 refuse"
+              "127.0.0.0/8 allow"
+              "::1/128 allow"
+              "${ipv4.subnet} allow"
+              "${ipv6.subnet} allow"
+            ];
 
-          localControlSocketPath = "/run/unbound/unbound.socket";
-        };
+            cache-min-ttl = 0;
 
-        prometheus.exporters.unbound = {
-          enable = true;
-          listenAddress = mkDefault this.wireguard.ipv4.address;
-          port = 9167;
-          inherit (config.services.unbound) group user;
-          unbound.host = "unix://${config.services.unbound.localControlSocketPath}";
-        };
-      };
+            serve-expired = true;
+            serve-expired-reply-ttl = 0;
+
+            prefetch = true;
+            prefetch-key = true;
 
-      systemd = {
-        services = {
-          unbound.after = [ "unbound-adblock-update.service" ];
-
-          unbound-adblock-update = {
-            serviceConfig = with config.services.unbound; {
-              Type = "oneshot";
-              User = user;
-              Group = group;
-              ExecStart = getExe (
-                pkgs.writeShellApplication {
-                  name = "unbound-adblock-update";
-                  runtimeInputs = [
-                    pkgs.curl
-                    package
-                  ];
-                  text = ''
-                    curl \
-                      -s \
-                      -o ${adblock-conf} \
-                      "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/multi.blacklist.conf"
-
-                    if [[ -f "${localControlSocketPath}" ]]; then
-                      unbound-control reload
-                    fi
-                  '';
-                }
-              );
-            };
+            hide-identity = true;
+            hide-version = true;
+
+            extended-statistics = true;
+
+            log-replies = false;
+            log-tag-queryreply = false;
+            log-local-actions = false;
+
+            verbosity = 0;
           };
-        };
 
-        timers.unbound-adblock-update = {
-          requires = [ "network-online.target" ];
-          after = [ "network-online.target" ];
-          timerConfig = {
-            OnCalendar = "daily";
-            Persistent = true;
-            Unit = "unbound-adblock-update.service";
+          forward-zone = [
+            {
+              name = ".";
+              forward-tls-upstream = true;
+              forward-addr =
+                let
+                  mkDnsOverTls =
+                    ips: auth:
+                    map (
+                      ip:
+                      concatStrings [
+                        ip
+                        "@"
+                        auth
+                      ]
+                    ) ips;
+                in
+                mkDnsOverTls dns.const.quad9.default "853#dns.quad9.net";
+            }
+          ];
+
+          cachedb = with config.services.redis.servers.default; {
+            backend = "redis";
+            redis-server-host = bind;
+            redis-server-port = port;
+          };
+
+          rpz = {
+            name = "hagezi.pro";
+            zonefile = "hagezi.pro";
+            url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt";
           };
-          wantedBy = [ "timers.target" ];
         };
+
+        enableRootTrustAnchor = true;
+
+        localControlSocketPath = "/run/unbound/unbound.socket";
+      };
+
+      prometheus.exporters.unbound = {
+        enable = true;
+        listenAddress = mkDefault this.wireguard.ipv4.address;
+        port = 9167;
+        inherit (config.services.unbound) group user;
+        unbound.host = "unix://${config.services.unbound.localControlSocketPath}";
       };
+    };
 
-      boot.kernel.sysctl."net.ipv4.tcp_fastopen" = mkOverride 200 3;
+    boot.kernel.sysctl."net.ipv4.tcp_fastopen" = mkOverride 200 3;
 
-      topology = with cfg; {
-        nodes.${this.hostname}.services.unbound = {
-          name = "Unbound";
-          icon = "${inputs.homelab-svg-assets}/assets/unbound.svg";
-          details.listen.text = concatMapStringsSep "\n" (i: "${i}:53") (
-            filter (i: i != "127.0.0.1" && i != "::1") config.services.unbound.settings.server.interface
-          );
-        };
+    topology = with cfg; {
+      nodes.${this.hostname}.services.unbound = {
+        name = "Unbound";
+        icon = "${inputs.homelab-svg-assets}/assets/unbound.svg";
+        details.listen.text = concatMapStringsSep "\n" (i: "${i}:53") (
+          filter (i: i != "127.0.0.1" && i != "::1") config.services.unbound.settings.server.interface
+        );
       };
     };
+  };
 }